Attackers Chain JFrog Artifactory Flaws for Admin Control

Attackers chained two JFrog Artifactory flaws, CVE-2026-42018 and CVE-2026-42016, to gain admin access on self-hosted servers between August 15 and September 8, installing backdoors and malicious plugins. A separate critical flaw, CVE-2026-82329, was also exploited, with 49% of organizations remaining vulnerable two weeks after its patch.